Durian Malware Linked to Kimsuky North Korean Threat Actor
The North Korean threat group known as Kimsuky has been observed using a new Golang-based malware called Durian in targeted cyber attacks against two South Korean cryptocurrency companies. According to security researchers, Durian is a previously undocumented malware with advanced backdoor capabilities allowing it to execute commands, download files, and exfiltrate data.
The attacks occurred in August and November 2023 and involved the exploitation of legitimate South Korean software to infiltrate systems, although the specific method used to compromise the software remains unclear. What is known is that this software establishes a connection to the attackers' server to retrieve a malicious payload, initiating the infection process.
Infection Chain of the Durian Malware
The initial stage serves as an installer for additional malware, establishing persistence on the host and paving the way for a loader malware that ultimately executes Durian. Durian, in turn, is used to introduce more malicious software, including Kimsuky's preferred backdoor, AppleSeed, a custom proxy tool named LazyLoad, and legitimate tools like ngrok and Chrome Remote Desktop.
Researchers noted that the attackers aimed to steal browser-stored data such as cookies and login credentials. A notable aspect of the attack was the use of LazyLoad, previously associated with Andariel, a sub-group within the Lazarus Group, suggesting potential collaboration or overlap between threat actors.
Kimsuky has been active since at least 2012 and is also known by other names including APT43, Black Banshee, Emerald Sleet (formerly Thallium), Springtail, TA427, and Velvet Chollima. The group is believed to operate under the 63rd Research Center, a division of North Korea's Reconnaissance General Bureau (RGB), the country's premier military intelligence agency.
The primary objective of Kimsuky actors, as highlighted by the U.S. FBI and NSA in a recent alert, is to gather stolen data and valuable geopolitical insights for the North Korean regime by compromising policy analysts and other experts.
